3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
88 lines
3 KiB
Text
88 lines
3 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-01:29 Security Advisory
|
|
FreeBSD, Inc.
|
|
|
|
Topic: rwhod allows remote denial of service
|
|
|
|
Category: core
|
|
Module: rwhod
|
|
Announced: 2001-03-12
|
|
Credits: Mark Huizer <xaa@xaa.iae.nl>
|
|
Affects: All released versions of FreeBSD 3.x, 4.x.
|
|
FreeBSD 3.5-STABLE prior to the correction date.
|
|
FreeBSD 4.2-STABLE prior to the correction date.
|
|
Corrected: 2000-12-23 (FreeBSD 3.5-STABLE)
|
|
2000-12-22 (FreeBSD 4.2-STABLE)
|
|
FreeBSD only: NO
|
|
|
|
I. Background
|
|
|
|
rwhod(8) is a server which implements the rwho protocol, which
|
|
communicates information on system uptime and logged-in users between
|
|
machines on a network.
|
|
|
|
II. Problem Description
|
|
|
|
Malformed packets sent to the rwhod daemon could cause it to crash,
|
|
thereby denying service to clients if rwhod is not run under a
|
|
watchdog process which causes it to automatically restart in the event
|
|
of a failure. The rwhod daemon is not run in this way in the default
|
|
invocation from /etc/rc.conf using the rwhod_enable variable.
|
|
|
|
All versions of FreeBSD 3.x and 4.x prior to the correction date
|
|
including 3.5.1-RELEASE and 4.2-RELEASE are vulnerable to this
|
|
problem, if they have been configued to run rwhod (this is not enabled
|
|
by default).
|
|
|
|
III. Impact
|
|
|
|
Remote users can cause the rwhod daemon to crash, denying service to
|
|
clients.
|
|
|
|
IV. Workaround
|
|
|
|
Implement packet filtering at perimeter firewalls or on the local
|
|
machine using ipfw(8)/ipf(8) to prevent untrusted users from
|
|
connecting to the rwhod service. The rwhod daemon listens on UDP port
|
|
513 by default.
|
|
|
|
V. Solution
|
|
|
|
Upgrade your vulnerable FreeBSD system to 3.5-STABLE or 4.2-STABLE
|
|
after the respective correction dates.
|
|
|
|
To patch your present system: download the relevant patch from the
|
|
below location, and execute the following commands as root:
|
|
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-01:29/rwhod.patch
|
|
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-01:29/rwhod.patch.asc
|
|
|
|
This patch has been verified to apply to FreeBSD 4.2-RELEASE and
|
|
FreeBSD 3.5.1-RELEASE. It may or may not apply to older releases.
|
|
|
|
Verify the detached PGP signature using your PGP utility.
|
|
|
|
# cd /usr/src/usr.sbin/rwhod
|
|
# patch -p < /path/to/patch
|
|
# make depend && make all install
|
|
|
|
Kill and restart rwhod to cause the changes to take effect. If you
|
|
have started rwhod with non-standard options (e.g. by setting
|
|
rwhod_flags in /etc/rc.conf) then the below command will need to be
|
|
modified appropriately.
|
|
|
|
# killall -KILL rwhod
|
|
# /usr/sbin/rwhod
|
|
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v1.0.4 (FreeBSD)
|
|
Comment: For info see http://www.gnupg.org
|
|
|
|
iQCVAwUBOq1fmlUuHi5z0oilAQG05QP/bQpUXpXc+X3/k/jbqgxjNOXwfzYRwNph
|
|
trCjRBKDKZrBGvlS2mTSbyisn6Rcv5PhigVAmU7sllrrXmYDCuMjNoMQqIhRwMax
|
|
ojaklsg6F8rX3zNwUlaQp45ZYiJ9Zi34kkRRnZQ5oAFciS6I/3tYnP9t0Sedbbsi
|
|
V/na+hI/Gtk=
|
|
=TskQ
|
|
-----END PGP SIGNATURE-----
|